Loading…
This English version is provided for convenience. The French version is the legally binding one.Your CV file is never kept on our servers without your agreement (only if you keep it in your account, encrypted), an account is optional and no IP address is stored in plain text. Here is exactly what is processed, why, for how long and by whom.
Mathieu Altavilla, 11 rue Maryse Bastié, 75013 Paris, France, reachable via the contact form (see the legal notice).
On the server side, all that remains are technical logs with no content (model used, number of tokens, cost, duration, recognised occupation; type of action and device in the activity log) and anonymous counters. Anthropic keeps the data received through its API only for a limited period (30 days at most under its commercial terms), except where required by law or for abuse monitoring, and does not use it to train its models.
A good CV needs no photo, no age, no family situation and no social security number, nor any information about your health, a disability, your religion or your opinions. Remove them before uploading your CV: they play no part in the calculation and the improved CV never includes them. If your CV contains any all the same, by uploading it you agree to their being read by the AI for this analysis only (Article 9(2)(a) of the GDPR); they are neither used nor kept.
The estimate, the score and the fixes are information for you. No decision producing legal effects concerning you is taken on that basis, and nothing is passed on to an employer or a recruiter.
The analysis texts, the “word-for-word” fixes, the questions asked before the rewrite and the improved CV are generated by an artificial intelligence model (Claude, by Anthropic) and labelled as such. Amounts, percentages and scores are calculated by the site. The AI does not make up any figures: a quantified result that is not in your CV is replaced by “[X]”, for you to fill in. Always reread your CV before sending it: you remain responsible for its content (see the terms of use).
| Processing | Data | Purpose and legal basis | Retention period |
|---|---|---|---|
| CV analysis (“What am I worth?”, ATS check) | The uploaded CV (file or pasted text), which may contain your identity, your contact details and your career history; the job offer you are targeting (optional); anti-bot token; “nss_ai” cookie and IP address hash for the quota | Producing the analysis you request (performance of the service); preventing abuse (legitimate interest) | Not kept by the site: processed in memory, then forgotten. Anthropic: limited period, 30 days at most |
| Questions and improved CV | The CV sent back by your browser, the signed ticket, your goal, the target job, the pasted job offer, your answers and what you want to change (optional) | Rewriting your CV at your request (performance of the service) | Not kept by the site; Anthropic: as above |
| Results on your device | Latest analysis, latest improved CV and CV file, in your browser's storage (see below) | Letting you review and improve your CV without uploading it again | Until you click “Clear my data from this device” or clear the site's data |
| Account (optional) | Email address, password hash (scrypt, never the password), dates of creation, sign-in and choice of password, email preference, hashes of the link received by email and of the session | Providing your account and sign-in by email and password, confirming your address (performance of the service). Tips and news by email only if you have agreed to it (consent, which you can withdraw at any time) | Until the account is deleted (immediately, from your account); deleted automatically after 2 years without sign-in. Account creation or new password link: 30 minutes (invitation: 7 days); session: 90 days |
| AI credits and Pro version | Number of AI edits of CVs already made, credits added, date of your “Notify me” request for the Pro version | Applying the free offer (performance of the service); notifying you by email of the launch of Pro, only if you asked for it (consent) | Until the account is deleted |
| Account history | Type of action and date (sign-in, analysis, CV rewritten or edited, saving, download…) and a few numbers (number of changes); never the content of your CV or what you write | Support, abuse prevention, credit management and service statistics (legitimate interest) | 400 days, erased immediately with the account |
| Invitations | Email address invited by the site's publisher, date, credits offered, link hash | Sending the invitation, once only, with no reminder (legitimate interest) | Accepted: attached to the account and erased with it. Otherwise: erased 30 days after the link expires |
| Saved analyses | Recognised profile (job, experience, qualification, city), settings, ATS robots score and analysis texts; never the CV file | Finding them again in your account (performance of the service) | Until they or the account are deleted; 50 at most, the oldest being replaced |
| Saved improved CVs | The content of the improved CV you choose to save (it contains your name and contact details), encrypted before being stored | Finding it again, editing it and downloading it (performance of the service) | Until they or the account are deleted; 20 at most, the oldest being replaced |
| PDF CVs you keep (“same layout”) | The PDF file you choose to keep: your original CV, or your CV organised, regenerated or with its new photo (it contains your name, your contact details and your photo, if any), its name and its versions (the edited texts, your request). Our AI gives the CV a short name and each version a title and a summary (the CV text and the changes are sent to it for this, nothing is kept on its side). Everything is encrypted (AES-256-GCM) before being stored: the file in private storage (Vercel Blob, Frankfurt), the name, the titles and the versions in our database | Finding it again, editing it further and downloading it whenever you like (performance of the service) | Until they or the account are deleted; 10 CVs at most, 30 versions per CV (the oldest being replaced) |
| AI feature quotas | Signed “nss_ai” cookie (random identifier, not linked to your identity) or your account identifier; hash of your internet connection (IP address reduced to your router) as a safeguard, signed in or not | Limiting the number of analyses, questions and rewrites per day, questions to Nego per week, and to 10 requests per day for the other AI features (legitimate interest: cost control, abuse prevention) | Cookie: 30 days; counters: 24 hours (questions to Nego: 8 days) |
| Personal context | The text you write in “Your context” (situation, goal, what your CV doesn't say), if any | Sending it to the AI with your CV for the analysis and each edit you ask for (performance of the service) | On your device until you clear it; with an account, also in the account, encrypted, until you clear it or delete the account |
| Abuse prevention | Hash of your internet connection (HMAC with a secret salt of your IP address's network: the IPv4 address, or the first four groups of an IPv6 address, i.e. your router), never the IP itself; device hash (“nss_ai” cookie) and, without an account, the number of trial credits it has used; simplified form of your email address (without dots or “+tag” for Gmail) so that one mailbox opens only one account | Giving free credits only once per device and internet connection, counting the trial without an account and deducting it from the free credits of the account then created or opened from that device, limiting the accounts created from one connection, applying the blocks decided in case of abuse (legitimate interest: cost control, abuse prevention) | Free credits and trial without an account: 365 days for the device (after its last action for the trial), 90 days for the connection (kept after the account is deleted, no longer linked to it); blocked connection: 7 days; simplified address: with the account |
| Activity log | Type of action (analysis, CV rewritten or translated, PDF edited, download, search, sign-in…), date, outcome (successful, failed, blocked by a quota) and a few settings or numbers (document type, goal, language, number of changes, estimated AI cost, the nature of the request as categories such as “translation” or “skill added”, never its text); pseudonymous device identifier (hash of the “nss_ai” cookie, never the cookie itself), browser and operating system (read from the header sent by your browser, which is not kept), country of connection provided by the host, account if signed in. Never the content of your CV, what you write or your IP address; salary contributions are not included | Security, abuse prevention and monitoring of the service: knowing which features are used and spotting abnormal use (legitimate interest) | 90 days; entries linked to an account are erased with it |
| Usage counters | Numbers aggregated per day (analyses, rewrites, downloads, accounts created), without any identifier | Managing the service and its costs (legitimate interest) | Daily detail: 120 days; cumulative totals, anonymous, no time limit |
| Browsing the site | The host's technical logs (IP address, URL, browser) | Operation and security of the service (legitimate interest) | The host's technical retention period, a few days |
| Anonymous contribution | Job, municipality, years of experience, gross salary, variable pay, cadre (executive) status, contract type, full-time, company size, sector, salary year. IP address hash (HMAC with a secret salt), never the IP itself | Calculating the “reported salaries” series, combating abuse (legitimate interest). No free-text field, no email: contributions cannot be used to identify you | Contribution: no time limit, in aggregated form only, beyond 10 contributions. IP hash: purged after 30 days |
| Unlocking the details | Signed “nss_unlock” cookie containing only its date of issue | Showing the details reserved for contributors (performance of the requested service) | 365 days |
| Nego (conversational agent) | Your messages, the attached file (CV, photo) and your personal context, sent to the model to answer together with the tools' results; the technical “nss_ai” cookie and a signed conversation token (2 h) for quotas | Answering and acting on your request, under the same rules as the other features (performance of the requested service) | Without an account: nothing on the server, apart from the activity log without content. With an account: the text of your questions (no attachment or answer), encrypted, 90 days, to monitor the service and improve Nego (legitimate interest), deleted with your account and included in your data export. A turn interrupted by an action in your browser is kept for at most 15 minutes, without the file; the conversation and the documents produced stay on your device (“nss_nego_v1”), cleared in one click |
| AI salary search | The job, location and experience entered, or the sentence typed; the IP hash and the technical “nss_ai” cookie for quotas | Searching for salaries published on the web with our AI and showing the sources (performance of the requested service) | Result (search and sources found) cached for 7 days, not linked to you, to answer the same search instantly; quotas: rolling 24 hours |
| Contact form | Subject and message; first name and email if you provide them; the IP hash to limit submissions | Replying to you and improving the site (legitimate interest) | Not kept by the site: forwarded by email to the publisher (Resend), kept in the publisher's mailbox while your request is handled; IP hash: 1 hour |
| Salary expectations generator | Job, location, experience, context, current salary and range (optional), strengths (300 characters) | Writing the requested answers (performance of the service) | Not kept beyond generation; anonymous count of generations per hashed IP for 24 h |
| “And you?” | The salary you enter | Calculating the percentile | Processed in your browser only, never sent or saved |
| Dictation (microphone button in the fields) | Your voice, for the length of the dictation | Writing in the field for you. The transcription is done by the speech recognition of your browser or your phone (Apple, Google…), under its own rules, and only after you have allowed use of the microphone | Nothing is received or recorded by the site: only the text written in the field is sent, when you submit the form, just as if you had typed it |
| Site audience measurement (no consent needed, exempt) | Pages viewed (address without parameters), entry page, domain of the referring site, campaign, originating search engine or assistant, device type, browser and operating system (read from the header sent by your browser, which is not kept), country of connection provided by the host, language, usage events (feature started, succeeded or failed, button clicked, reading time; never the content of your CV, what you write or an amount), pseudonymous identifier derived from a random 13-month cookie (“nss_m”, never the cookie itself), never your IP address | Measuring the site's audience and usage, for us alone: anonymous statistics, no data passed on or cross-referenced with any other processing (neither the activity log nor your account). Consent exemption provided by the CNIL for audience measurement (article 82 of the French Data Protection Act). The host also provides cookie-free measurement (Vercel Web Analytics) | Cookie: 13 months, never extended; data: 25 months. Objection: the “Do not count me” button |
| Detailed measurement (Mixpanel), with your consent | Pages viewed (address without parameters), clicks on the main buttons, domain of external links clicked, usage events (never the content of your CV or a salary amount) | Understanding how the site is used in detail (journeys, cohorts); consent given in the banner, changeable at any time via “Manage my choices” | Consent choice remembered for 182 days; data held by Mixpanel (European Union) |
Transfers outside the European Union (Vercel, Anthropic, Resend, Cloudflare) rely on the European Commission's standard contractual clauses and, where applicable, on the EU–US Data Privacy Framework.
No advertising cookie and no third-party tracker is loaded without your consent. You can change your choice at any time: .
The site's audience measurement does not require consent (an exemption provided by the CNIL: anonymous statistics, for us alone), but you can object: this browser will no longer send anything. The choice applies to this browser, for 13 months, and can be changed here at any time.
Reading your choice…
You have the rights of access, rectification, erasure, restriction, objection and portability provided for by the GDPR, as well as the right to give instructions on what happens to your data after your death. With an account, you exercise most of them yourself from your account: viewing and deleting your analyses and your CVs (original PDFs and versions included), downloading all your data (a JSON file, plus your PDFs from your account), withdrawing your consent to emails, deleting your account. Without an account, our servers keep only your device's activity log (random identifier, 90 days), audience measurement (pseudonymous identifier, 25 months, you can object) and anonymous counters; your results are on your device. As contributions are anonymous, we cannot find the one that belongs to you: write to us with the date and the values you entered so that we can identify it as best we can.
Contact: contact form. Reply within one month. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
Accounts are reserved for people aged 15 and over. Analyses without an account are open to everyone; if you are under 15, ask a parent before uploading your CV.
Last updated: 3 November 2026. This policy evolves with the service; in the event of a significant change (new use of your data, new paid option), account holders are notified.